Investigators should always rely on screenshots as primary evidence in cyber investigations.

Screenshots arenot considered primary evidencebecause they can beeasily altered or fabricated. Digital forensic practices require:

Website archive tools (e.g., Wayback Machine).

Metadata analysisfor verification.

Log extractionsfrom web servers.

References:McAfee Institute CCII OSINT Techniques, Cyber Crime Investigator’s Field Guide​.